Signal has been blocked by Venezuela and Russia
"Signal is being blocked in Venezuela and Russia. The app is a popular choice for encrypted messaging and people trying to avoid government censorship, and the blocks appear to be part of a crackdown on internal dissent in both countries..."
https://www.theverge.com/2024/8/9/24217008/signal-blocked-venezuela-russiaOpen linkView original on feddit.uk
89 replies
It’s like a medal of honor for a privacy preserving app 😄
Indeed. If whatsapp isn't on the list, then I have all the confirmation I need.
https://kyivindependent.com/messenger-signal-blocked-in-russia-media-says/
Some US bank got in trouble for using it internally.
in trouble with who?
This is a story from August 2023, and was covered in many outlets (I quote here NYT for reference only)
Original NYT
Archived version
Zucks check didn't clear yet.
https://www.msn.com/en-us/news/world/maduro-calls-venezuelans-to-delete-whatsapp-in-growing-crackdown/ar-AA1oi4vz
Maduro uninstalled whatsapp live on television a few days ago
"Banned in 15 dicatorships!"
could matrix.org be as easily blocked, since it's decentralized I'm wondering?
At least it means that Signal is working as intended if they are blocking it, I guess that they don't have back doors.
Being decentralized prevents DNS or IP blocks but not blocks through DPI.
Signal has an option to masquerade it's traffic as regular HTTPS, I don't know if Matrix can do such a thing.
https://x.com/signalapp/status/1821979304626155930
I can answer this! All matrix calls are over https APIs. Ports and addresses are stored in a text file on the base domain or in DNS txt entry.
Thanks, nice to have someone knowledgeable.
Would you say matrix is censorship resistant? I've very limited knowledge of it but given what you said I imagine that if I was trying to block matrix I would just need to query the url of the text file and check the DNS text entry, if either exist just add the domain to the blocklist.
Ok this raises a question for me. How do you find a url like this which wouldn't be like, "linked on their site" or something? I know it must be possible to like dump a URL list for a site to a textfile, I'm just wondering how.
Like say I want to find all the super secret pages on www.subgenius.com, they link some but say www.subgenius.com/pam1/pamphlet.html wasn't directly linked (it is, but pretend lol) but could be accessed by the URL, how would I find that URL? Can you just run like
someprogram -a www.subgenius.com -o subgenius.txtbecause that would be cool.Maybe I've misunderstood how it works. I thought that when connecting to a matrix instance you would point to the domain name and the text file would be on a standard location (as with
/robots.txtor all the files in/.well-known/) so it would be easily discoverable. In fact I just checked and matrix does use/.well-known/so one should be able to identify matrix servers by querying these URLs. Unless their is a way to use a non-standard location, but that would require further configuration on the client I guess.And just to answer your question, the only way to find some hidden file would be to brute force. This could obviously be extremely time consuming if the URL is long and random enough, especially if you add rate limiting (this last thing could be circumvented by using multiple IPs to scan, which would be easy for a state actor).
Edit: I've just realized I wasn't answering to the same person, the first part of the message was more for @[email protected]
Ah maybe I've misunderstood then, lol. I didn't know any of that. Oh well!
Yeah the main thing is that the ports and addresses can change and it's nbd. From a firewall perspective, it's impossible to block them all. Especially when the clients are doing mundane https requests. Even if the server goes down or partial connectivity, the channel can still be used.
But this seems easy to automatically block, no? If a client is querying an unknown domain check for some Matrix related data in
/.well-known/and add it to the block list if there is. And since the servers are publicly advertising the port used you just need to periodically check the list of known matrix domains you are creating in the first step.Russia is already doing DPI and blocking ESNI so that seems easy. A more widespread usage of ECH would help everyone, as is Signal advocating, but that's not the case yet.
Matrix is in fact decentralized but in reality it is not so much, I don't know the number exactly but the majority of users use the matrix.org server
Those numbers only include instances that have telemetry enabled
Do you have numbers without?
How would you?
No clue, not familiar with Matrix to that level.
I mean, that's not specific to Matrix. Telemetry is the tool used to get the numbers, so I don't see how you would collect numbers on servers that don't report numbers.
Theoretically they could be reported by federated servers that do have it enabled
Im surprised there are zero calls to any official matrix server(s) from those instances.
Not even random API for metadata, update status, etc?
Telemtry is a word. It only means as much as it means in each context, and without full context it means little atm.
Do you have a resource where I could learn more about what data Matrix considers telemetry?
People who live in countries where DNS and IP blocks are common probably use a different server. I've been running my own for over a year and it works like a dream
Or SimpleX?
It cannot be easily blocked especially if you use your own homeserver every homeserver replicates the channel and it can operate without the original server! That's why signal and telegram are inherently flawed.
To be devils advocate in a sense, this may mean that it doesn't have any backdoors that Russia or Venezuela can use, but the NSA or something still could have one of their own.
Matrix doesn't have encryption as the default
Also Signal doesn't have any backdoors. I can say that with high certainty as it has been audited more than any other messager.
It doesn't matter if it is a business entity operating under a government then you can never really know because gag orders. Centralized servers can be blocked. Telegram and Signal apps could have a back door. This is why open stack is important. And not just the code. Also encryption is default for p2p one on one conversations. It's not in channels by default because it can complicate public use.
Yes
Signal honored!
Would peer to peer apps be resistant to this sort of thing?
Yes, but you'll have to install them from sources other than what governments deem official. Like F-droid.
Now, if they block p2p traffic that's a different story
I am totally cool with F-droid.
why telegram is not blocked? makes you think...
WhatsApp supposedly uses Signal protocol.
Why is THAT not blocked? Certainly they wouldnt roll their own encryption and bypass Signal security protocols after having Moxie come in, right? Right????
Russia is reportedly planning to block WhatsApp as well.
It is owned by Meta and is proprietary
Telegram is not secure, I guess if you can listen to it better not block it.
I mean it was blocked before Signal was blocked. Russia somewhat famously badly broke their Internet trying to shutdown telegram... and eventually gave up.
I'm guessing Signal finally has enough market share to get the Russian government's attention but not enough market share that they think the web of proxies that kept Telegram online will keep Signal online.
or maybe they came to an agreement on mutually beneficial terms
Maybe, maybe not, maybe I'm a duck in a suite.
Some say it was unblocked because they made a deal with Durov. Another opinion is that too many people and services including officials continued to rely on it even during the time it was blocked. Regardless, Telegram did a huge job on circumventing those blocks.
It isn't private
Honestly I would've expected it to be blocked much earlier
You need a certain market saturation before a ban becomes useful. If very few people are using the service, there's little incentive to invest time/energy in a block.
I suspect the recent wave of riots in the wake of the election is driving the urgency.
That's what would've means?
So signel proxy for the win?
https://signal.org/blog/proxy-please
Why countries that do not prosecute political dissent bock apps used by political dissenters? /s
matrix stays winning
Matrix isn't secure depending on how you use it. It also doesn't protect individual identities terribly well.
Simplex Chat would be the better option however the main Simplex Chat server and matrix server could end up blocked as well.
Matrix is entirely self-hostable, and you can turn off both federation, and the requirements for any linkable identifiers.
Signal by contrast requires your phone number, isn't self-hostable, and is based in a five-eyes country.
Matrix doesn't protect metadata, which is arguably just as (if not more) important than message data. Signal by contrast does protect metadata and proper implements Perfect Forward Secrecy for all chats. I do think Signal's centralized design and phone number requirements problematic, but Signal still has many merits. Such as its massive user base for a AGPL-only project.
Citation needed. It is undisputed that the software that runs on their servers is not identical to the code they release; if they release at all because sometimes they just stop for a year, until people complain 🫠
This is false. You still need a phone number to sign up and it is used as an internal identifier.
All they did is to optionally allow you to hide your phone number from other users.
plenty of servers for both though
Couldn't they block them too? Monitor the domains people connect to, check if it's a Matrix server and block it if it is.
What would a blockchain provide here?
buzzwords
Overhead
The overwhelming majority of users are on the main servers. It also impacts self hosted Matrix servers that use the matrox.org identity server.
Probably mostly because almost nobody uses it.
Couple million is absolutely nobody /s
Almost is absolutely \s
they figured it out that it's CIA :)
Smart move, considering Signal is a US-hosted centralized service that has to comply with US NSL laws.
These comments below seem to be unaware of all the issues privacy advocates have of signal.
I don't get it, are you really arguing that Russia and Venezuela are blocking Signal to protect their citizens from American snooping?
All countries should ban US-domiciled companies like signal, or any communication platform hosted in Five-eyes countries, and especially ones domiciled in the US, which has to adhere to National Security Letters.
https://www.eff.org/issues/national-security-letters/faq
Isn't the whole point of something like End-to-End Encryption so that not even the company themselves can read your messages?
In that case it wouldn't matter even if they did turn the info over.
Edit: I read more into the page you linked. Looks like those NSLs can't even be used to request the contents either way:
You can read my article, or Drew Devaults on why he doesn't trust signal, which get more into this, but the short version is that US security forces don't have time to read the content of everyone's message anyway, they care more about the metadata: message timestamps and social graphs.
Signal stores all that data (via required phone numbers, meaning its linked to your real name and address), and via the US's key disclosure laws, it would be illegal for them to tell you that the US government is hoovering up that data.
Most security experts who actually know what they are talking about do recommend Signal for most users, including [https://twitter.com/Snowden/status/661313394906161152](Edward Snowden), [https://www.schneier.com/blog/archives/2018/06/russian_censors.html] (Bruce Schneier) and [https://linktr.ee/glenngreenwald](Glenn Greenwald). Eveyone should consider whether they would rather follow the advise of people who have literally fought the NSA and read the entire Snowden documents or belive in the FUD spread by some people here.
The company, or any middleman, can read your messages if they have the keys. In many services, the keys come from the company. EEE is only as trustworthy as the clients and processes you use.
Mass censorship is never good for civil liberties. Let people decide on there own.
Also Signal is cryptographically sound. Many other messagers use a similar protocol
As I commented below, US security forces aren't that interested in message content anyway, since they don't have time to parse through every message to construct meaning. Signal does require your phone number tho, as well as message timestamps, meaning they can build social graphs of real people. Tons of metadata living on a single US-based server.
It doesn't matter if it is US based. You shouldn't trust the server.
Signal has known issues. That doesn't mean it is entirely bad though. Saying things like Signal is insecure is simply untrue. It has weaknesses but it also has the benefit of protecting your messages completely and being well established.
My question was more about the motives in this case.
Well IMO all countries should have the motivation to prevent US spying on their country's populations. You generally don't know about honey pots before they get exposed.
The question of what should be done can be interesting, but that was not my question. It's obvious this is not the motive here.
If you are in your own country opposition it's better to use a foreign tool, even better if it's in a country that's not gonna collaborate with yours.
I imagine just using metadata you can look for people who are discontent, then provides list of those people to the opposition to contact and mobilize them and get them to protest.
Or target them with stories and bots to turn them into a revolutionary force, but that would be more useful for social media networks instead of signal.
Signal has strong cryptographic protocols that are not easily broken. It pioneered the use of double ratchet encryption. (Different keys for each message)
It does expose phone numbers to Signal and the US government but that may or may no be a concern depending on what your threat model is.
they hated him because he spoke the truth smh
use matrix, briar, simplex in that order
also what email platforms + vpns do you recommend, out of curiosity?
Matrix isn't as good as Simplex Chat. Briar is good as it is very hard to censor but it does use battery and requires you to be only all the time. (unless you count Briar mailbox)
sure, simplex is very private, but its also a pain in the ass to use currently. i feel like matrix makes a decent tradeoff between easy use and privacy